# Ways to access Origin Cloud

Reach Origin Cloud through the console, the origin CLI or the GraphQL API. All three act as a signed-in user or service account with the same permissions.

You work with Origin Cloud through the console, the `origin` CLI or the GraphQL API. All three talk to the same API and act as you, so they see the same organizations and are bound by the same roles. A change you make in one shows up in the others.

The following list shows how a person and an automated job reach the GraphQL API, and with which credential.

- **Person:** signs in on the login page, through the console or the `origin` CLI, which get an access token for the GraphQL API.
- **Automated job:** uses client credentials to get an access token for the GraphQL API.

## Key concepts [#key-concepts]

| Concept | What it is |
| --- | --- |
| Login page | Where people authenticate, with whatever sign-in methods your account has, including a second factor. Neither the console nor the CLI sees your password. See [Use the CLI](/docs/platform/access/cli). |
| Access token | A short-lived bearer token that every API request carries in its `Authorization` header. The CLI gets and renews one for you. See [Use the GraphQL API](/docs/platform/access/api). |
| Service account | A credential for automation, such as CI jobs and scripts, that authenticates as itself rather than as a person. See [Service accounts](/docs/iam/service-accounts). |
| Resource URN | The identifier the API and the CLI use for every resource. See [Use the GraphQL API](/docs/platform/access/api#resource-urns). |

## Compare the access methods [#compare-the-access-methods]

| Method | Best for | Authenticates as |
| --- | --- | --- |
| Console | Working in a browser | A person |
| `origin` CLI | Interactive work in a terminal and simple scripts | A person |
| GraphQL API | Automation, integrations, and anything the CLI doesn’t cover | A person or a service account |

The CLI covers organizations, projects, compute, storage, network and IAM. Some operations exist only in the API, among them billing accounts and payment methods, quotas, metrics and the audit log.

## What you can do [#what-you-can-do]

- [Install and use the CLI](/docs/platform/access/cli)
- [Call the GraphQL API](/docs/platform/access/api)
- [Create a service account for automation](/docs/iam/service-accounts)

## Related [#related]

- [Platform CLI commands](/docs/platform/reference/cli)
- [Error codes](/docs/platform/reference/errors)